Analysis
-
max time kernel
51s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 00:49
Static task
static1
Behavioral task
behavioral1
Sample
102608b8523ba1b517f92ba97fcae12e_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
102608b8523ba1b517f92ba97fcae12e_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
102608b8523ba1b517f92ba97fcae12e_JaffaCakes118.dll
-
Size
576KB
-
MD5
102608b8523ba1b517f92ba97fcae12e
-
SHA1
4283e402fb0bc7e02a5152d2a3e1893f0a8cad26
-
SHA256
2ebeeba37fa2b5d420fa2227cd932f511da532cc52ca54647612beb9bb79bf14
-
SHA512
8e93f1a23c0367f4b2f0b2c48794fa58be95d4594ffecce311573d320c98a81994fc2d7e4afdcafa197e1556275f6df59fea49a7716df15f8b8925738d010832
-
SSDEEP
6144:7ZLT3A5Dp0HvFIc5vBlcQGSgS62iiiiiSySYSGS+8c8c8AAANA/AA0fMGrgPhcl5:7ZL7A5l0711g8onrOcWAqVvgkclx
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 372 rundll32mgr.exe -
resource yara_rule behavioral2/files/0x000c0000000233da-3.dat upx behavioral2/memory/372-4-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral2/memory/372-8-0x0000000000400000-0x0000000000473000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 324 372 WerFault.exe 82 3524 2296 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2464 wrote to memory of 2296 2464 rundll32.exe 81 PID 2464 wrote to memory of 2296 2464 rundll32.exe 81 PID 2464 wrote to memory of 2296 2464 rundll32.exe 81 PID 2296 wrote to memory of 372 2296 rundll32.exe 82 PID 2296 wrote to memory of 372 2296 rundll32.exe 82 PID 2296 wrote to memory of 372 2296 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\102608b8523ba1b517f92ba97fcae12e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\102608b8523ba1b517f92ba97fcae12e_JaffaCakes118.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
PID:372 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 2644⤵
- Program crash
PID:324
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 6123⤵
- Program crash
PID:3524
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2296 -ip 22961⤵PID:4400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 372 -ip 3721⤵PID:208
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD548327ee6dec8ae239eff2ffb30403028
SHA145e4e5014944e1229c49f9e7ad4d0925d93a55bb
SHA256aa3d7c9d4576ca5b9848306ec5f1e3331d1227c9d1e20d2ea80ba611084bad6a
SHA5121c20199e6726237c47f9bd958e9a135778280a8c0e0a86f8bed05f98d199e1502bb54605b036c6a2a54fbc5c48407afaab1e08730e84f1a18d56f5ad3cb89316